WSTA Logo

WSTA Privacy Policy



The General Data Protection Regulation GDPR means that there are significant changes to requirements in the laws governing the way we manage your personal data. This is a high priority for the WSTA.

This privacy notice explains how we will process your personal information. It explains how we will protect your information and personal data, and the controls and safeguards we provide for this data. This includes understanding, at all times, precisely what data we are storing for and about you, who (if anyone) can see that data, and whether you give permission for that data to be shared with third-parties.

The processing of personal data, such as the name, address, e-mail address, or telephone number will always be in accordance with the General Data Protection Regulation (GDPR) and the Privacy and Electronic Communication Regulations (PECR).

By means of this privacy statement, we set out the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of their rights by means of this privacy statement.

 

Topics

1. Who we are?

2. The information we collect about you, why we need it and who it’s shared with?

3. Your privacy rights explained

4. Changes to our privacy policy

5. How to contact us or make a complaint

 

Who we are

The WSTA represents over 300 companies producing, importing, exporting, transporting and selling wines and spirits in the United Kingdom. We campaign for a vibrant and sustainable wine and spirit industry, helping to build a future in which alcohol is produced, sold and enjoyed responsibly.

Our objectives include:

  • Promoting the trade in wines and spirits and other alcoholic liquors in the United Kingdom and in other parts of the world and to support and maintain the status of the Wine and Spirit Trade and the character, status, and interests of all persons, firms and companies engaged in any branch or section of the trade;
  • Promoting the collaboration and co-ordination of various interest groups within the Wine and Spirit Trade and other similar or related trades;
  • Co-ordinating and assisting the work of affiliated associations promoting the interests of the Wine and Spirit Trade;
  • Assisting and encouraging research in connection with wines, spirits and other alcoholic liquors, to promote improvements in growing, making, manufacture, blending, distilling, rectifying, transportation, distribution and other relevant processes;
  • Advising Members on any matters relating to the Wine and Spirit Trade;
  • Establishing and promoting uniformity in commercial practices within the Wine and Spirit Trade;
  • Promoting the consideration and discussion of all questions affecting the Wine and Spirit Trade.

We are registered with the Information Commissioner’s Office (ICO) as a data controller with registration number Z4676859.

 

The information we collect about you, why we need it and who it’s shared with

  • The information that we collect will only be used lawfully (in accordance with the Data Protection Act 1998 and the General Data Protection Regulation 2018).
  • Unless required otherwise by law, your personal information will never be shared with any third party, other than other organisations and individuals who perform functions on our behalf or in partnership with us. These third parties are provided with personal information necessary to perform the task and may not use it for any other purpose.
  • To prevent unauthorised access to your information, we have put in place physical, electronic and managerial procedures to safeguard and secure the information we collect.
  • We want to respect your wishes about how, and if, you are contacted - whether by post, by phone or by email. You may tell us you do not wish to be contacted at all.

 

Website Users

Basis of processing: legitimate interest

1. The WSTA website does not collect personal data from you when you browse it. We do use Google Analytics to understand how the website is being used and how, or from where, people arrived at our website. This data is collected using cookies. Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. The cookies we use do not contain any personal information that can be used to identify you. You can configure your browser so that cookies are not used automatically but in a few cases, some of our website features may not function as a result.

2. We will collect personal data in the following cases:

  • If you sign in to our members area, we log the date of signing in against your user id. We can also keep track of what documents are downloaded and viewed.
  • If you post a Job to the Jobs Board we need to know who you are, your company details, how to contact you via telephone and/or email, and details relating to the job. We will also need to know how to apply for the job.
  • If you subscribe to the WSTA blog, we need your name and email address.
  • If you post an event on our Trade Diary, we need to know who you are, your company details, any additional organisers details, where the event is being held, what the event is called, a description of the event, who it’s for and how to contact you via telephone and/or email.
  • If you use the WSTA Trade Diary app, it does not collect any personally identifiable data from users. The app only publishes events data that has been delivered from the WSTA website via a dedicated web service.

3. Our website includes links to other sites which may be of interest to you. This privacy policy only applies to the WSTA website. We cannot, and have not, reviewed the sites linked to our site and cannot be held liable for their content. Users link to, and use, other sites at their own risk. As the internet uses an open system we cannot warrant that the site and downloads reach you virus-free. You must therefore, take all appropriate precautions for your own safety.

 

  • The legal basis for processing your data under this head is 'legitimate interest'.
  • We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

 

Members, Supporters and Lapsed Members

Basis of processing: contract and legitimate interest

1. We collect business contact details when a business becomes a WSTA member. These contact details may include, but are not limited to, the business name and trading name, address(es), website address, telephone number(s), registered company number and VAT number (where applicable).

2. When a business becomes a WSTA member we also collect details of named contacts nominated by, and within, the business. This will include, but may not be limited to, a person’s name, work email address, work contact number(s) and job title.

3. When a business becomes a WSTA member they enter into a contract and agree to the terms and conditions of membership. The WSTA provides that business with the membership benefits as stated – this includes contacting that business, via the nominated member(s) of staff, on areas that we consider may be beneficial to the business.

4. Data is collected when a business applies for membership, when staff members subscribe to publications, register for an event, voluntarily complete surveys, request information, advice or guidance from us and/or when they provide feedback to us.

5. If members attend an event held by, hosted by or in conjunction with the WSTA we may collect data relevant to that event e.g. dietary requirements for catering purposes. A guest list may also be provided if requested or required by the event organiser for legitimate reasons e.g. for security purposes or entry into the building.

6. We only share your data with select 3rd parties as listed below.

  • Mailchimp – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. Data uploaded to Mailchimp is updated at least fortnightly. Mailchimp are certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield Framework. Personal data entered into Mailchimp may be transferred from the EU to Mailchimp in the U.S. Mailchimp abides by the current GDPR regulations and their servers are in the UK.
  • CRM solution hosted by 7Global – to provide our Customer Relationship Database. 7Global abide by the current GDPR regulations and their servers are in the UK.
  • We do not share your data with other 3rd party services. When data is submitted via Eventbrite and/or Survey Monkey, this is submitted by you, not the WSTA, and falls under their relevant privacy statements.

7. We want to respect your wishes about how, and if, you are contacted. We record details of which WSTA committees and mailing lists you are included in, newsletters you’ve requested to receive, along with other membership benefits. You may also tell us you do not wish to be contacted at all, and we will respect your wishes.

8. All the information we collect is kept confidential and is processed to deliver our membership benefits and any other requests received, along with providing you with member benefits and other information the WSTA considers appropriate and relevant to your business.

 

  • The legal basis for processing your data under this head is ‘contract’, so that the WSTA can provide the services as part of membership. We also process information under this head based on ‘legitimate interest’, so that we can send you information that we consider may benefit you as a member or be of interest to you or the business.
  • We update our member contact details every 12 months. If a business ends its membership with the WSTA, this status will be reflected in the WSTA membership list immediately. Any personal data held on staff contacts will be deleted immediately. If a business continues to be in membership, but a staff contact leaves, their business contact details will be deleted immediately or as soon as WSTA is informed. Failing that, they will be held for a maximum period of 12 months, after which point they will be deleted.
  • After membership has ceased we will keep data on that business indefinitely. Personal contact details for staff within that business will be deleted immediately, however we will keep a copy of the original WSTA membership application contract for a period of 6 years. This contract will contain the main and invoice contacts at the time of application, their email address, and telephone number and the applicant’s signature. After 6 years, we will keep the business name, joining and leaving date, and reason for leaving but destroy the contract.
  • Whilst in membership we want to ensure that your data is accurate and up to date, and that it reflects your preferences. To do this, we will normally contact the business not less than every 12 months, though this may be sooner if we believe that your data may have changed.
  • We do not use your personal data for any automated decision making.

 

Prospective Members

Basis of processing: legitimate interest

1. PProspective members refer to businesses who are not currently members of the WSTA and who the WSTA consider would benefit from being in membership, or at least from knowing more information about the WSTA.

2. We collect data about prospective members when you register for an event, when you provide feedback to us and when you contact us for information and/or advice.

3. We gather information on prospective members from various sources, such as articles that we read, internet searches, coming across them ‘organically’ i.e. a search that leads to other searches, because of recommendations from current WSTA members and/or by attendance at WSTA and non-WSTA events and training courses.

4. We only share your data with select 3rd parties as listed below.

  • Mailchimp – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. Data uploaded to Mailchimp is updated at least fortnightly. Mailchimp are certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield Framework. Personal data entered into Mailchimp may be transferred from the EU to Mailchimp in the U.S. Mailchimp abides by the current GDPR regulations and their servers are in the UK.
  • CRM solution hosted by 7Global – to provide our Customer Relationship Database. 7Global abide by the current GDPR regulations and their servers are in the UK.
  • We do not share your data with other 3rd party services. When data is submitted via Eventbrite and/or Survey Monkey, this is submitted by you, not the WSTA, and falls under their relevant privacy statements.

5. The personal data we hold/collect may include, but not be limited to, your name, job title, company details, email address, phone number and mobile phone number.

6. We do not share non-member details with any 3rd parties.

 

  • The legal basis for processing your data is 'legitimate interest’, to respond to requests for advice and/or information and/or to provide you with information that we feel may benefit you by becoming a member of the WSTA or be of interest to you or your business.
  • We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
  • We do not use your personal data for any automated decision making or profiling.

 

Supporters and Sponsors

Basis of processing: legitimate interest

1. WSTA holds business contact details of non-member supporters. These include, but are not limited to, groups such as MP’s, MEP’s, MSP’s, Assembly Members, Councillors and their staff and any other people with a professional role in Parliament and/or politics. The details we hold will include, but may not be limited to, a person’s name, work email address, work contact number(s), job title and political party preference.

2. When applying for membership, applicants provide the business and contact details of two sponsors. These details include a contact name, company name and a contact email address. As part of the membership approval process, sponsors will be contacted via email, and asked to verify the relationship, trade or otherwise, with the applicant. They will be asked to supply any other information to support the application.

3. Data is collected when a supporter or sponsor supports a membership application, subscribe to publications, register for an event, voluntarily complete surveys, request information, advice or guidance from us and/or when they provide feedback to us.

4. If supporters attend an event held by, hosted by or in conjunction with the WSTA we may collect data relevant to that event e.g. dietary requirements for catering purposes. A guest list may also be provided if requested or required by the event organiser for legitimate reasons e.g. for security purposes or entry into the building. This would include basic information such as your name, title and job description.

5. We only share your data with select 3 parties as listed below.

  • Mailchimp – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. Data uploaded to Mailchimp is updated at least fortnightly. Mailchimp are certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield Framework. Personal data entered into Mailchimp may be transferred from the EU to Mailchimp in the U.S. Mailchimp abides by the current GDPR regulations and their servers are in the UK.
  • CRM solution hosted by 7Global – to provide our Customer Relationship Database. 7Global abide by the current GDPR regulations and their servers are in the UK.
  • We do not share your data with other 3rd party services. When data is submitted via Eventbrite and/or Survey Monkey, this is submitted by you, not the WSTA, and falls under their relevant privacy statements.

6. We want to respect your wishes about how, and if, you are contacted. We record details of any WSTA committees and mailing lists you are included in or newsletters you’ve requested to receive. You may also tell us you do not wish to be contacted at all, and we will respect your wishes.

7. All the information we collect is kept confidential and is processed to provide you with information the WSTA considers appropriate and relevant to you.

 

  • The legal basis for processing your data under this head is ‘legitimate interest’, so that we can send you information that we consider may benefit you as a sponsor or supporter or be of interest to your business.
  • We will keep supporters data indefinitely. We want to make sure that your personal data is accurate and up to date.  You may ask us to correct or remove information you think is inaccurate.
  • If you provide a sponsor reference for a WSTA member, we will keep your name, business name, email address, date of reference and the contents of your reference for the duration of that business’s membership with the WSTA. When the business leaves WSTA membership, we will keep their original contract, including your sponsor reference name, business name, and email address, for a period of 6 years, after which it will be destroyed.
  • We do not use any personal data for automated decision making or profiling

 

Event attendees and Webinar participants

Basis of processing: legitimate interest

1. If you attend, or sign up for an event, training course or webinar hosted by, or in conjunction with the WSTA, we collect personal data which may include, but not be limited to, the participants name, business name (if relevant), job title, business address(es), business telephone number(s) and email address. We may also collect additional data relevant to that event e.g. dietary requirements for catering purposes. A guest list may also be provided if requested or required by the event organiser for legitimate reasons e.g. for security purposes or entry into the building.

2. We only share your data with select 3rd parties as listed below.

  • Mailchimp – to provide our email mailing service. The information uploaded includes your name, email address, job title and organisation. Data uploaded to Mailchimp is updated at least fortnightly. Mailchimp are certified to the EU-U.S. Privacy Shield Framework and the Swiss-U.S Privacy Shield Framework. Personal data entered into Mailchimp may be transferred from the EU to Mailchimp in the U.S. Mailchimp abides by the current GDPR regulations and their servers are in the UK.
  • CRM solution hosted by 7Global – to provide our Customer Relationship Database. 7Global abide by the current GDPR regulations and their servers are in the UK.
  • We do not share your data with other 3rd party services. When data is submitted via Eventbrite and/or Survey Monkey, this is submitted by you, not the WSTA, and falls under their relevant privacy statements.

3. We want to respect your wishes about how, and if, you are contacted. You may tell us you do not wish to be contacted at all, and we will respect your wishes.

4. All the information we collect is kept confidential and is processed to deliver a service to you.

 

  • The legal basis for processing your data under this head is ‘legitimate interest’, to respond to your requests to attend a course, event and/or sign up for a webinar.
  • We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
  • We do not use any personal data for automated decision making or profiling.

 

Complainants and Enquirers

Basis of processing: legitimate interest

1. We collect data about you when you register for an event, when you provide feedback to us and when you contact us for information and/or advice or to make a complaint.

2. The personal data we collect may include, but not be limited to, your name, email address, phone number, mobile phone number and business name (if relevant).

3. We do not share your details with any 3rd parties.

  • The legal basis for processing your data is 'legitimate interest’, to respond to requests for advice and/or information and/or to respond to your complaint and/or to provide you with any other information requested by you.
  • We will keep data indefinitely. We want to make sure that your personal data is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.
  • We do not use any personal data for automated decision making or profiling.

 

Suppliers, Contractors, Consultants, Guest Speakers and Service Providers

Basis of processing: contract and legitimate interest

1. We hold information about suppliers, contractors, consultants, guest speakers and service providers to enable us to employ your services or offer them to members.

2. The personal data we hold may include, but not be limited to, your name, trading name, job title, email address, phone number, mobile phone number and bank details.

3. The information is only disclosed to employees of the WSTA and contracted processors e.g. processing BACS transfers, sending postal mail and emails.

 

  • The legal basis for processing your data is ‘contract’, while we are your customer or ‘legitimate interest’, where you are offering services to members but have no direct contract with the WSTA.
  • When you are no longer an active supplier, the legal basis for processing your data is ‘legitimate interest’ because we may want to employ your services again.
  • We will hold your personal data for 6 years after your last invoice to us, after which time we will either delete it or keep it if you have asked us to.
  • We do not use your personal data for any automated decision making or profiling.

 

Employees, their families and dependents

Basis of processing: contract, consent and legitimate interest

1. We hold information about employees of the WSTA to enable us to employ, pay and manage your work. We also hold information about your next of kin in case of emergencies and about your family and dependents in relation to optional employee benefits.

2. While you work at the WSTA we hold information about your recruitment, about training and development, and about your performance. We keep information about any disciplinary proceedings.

3. Next of kin information and information about your family and dependents is destroyed when you stop working for WTSA. Other records are held for longer, including the dates of your employment so that we can provide references.

4. This information is not normally disclosed to anyone except the Chief Executive and the Head of Corporate Services.

5. In case of a dispute, or for legal purposes, we may need to disclose this information to the authorities or to other legal professionals.

 

  • The legal basis for processing your data is 'contract' whilst you are an employee, sometimes 'legal requirement' in case of certain records, such as payroll. Where we hold next of kin and family and dependent information, it is based on 'consent'. The legal basis for storing your data after your employment has ceased is ‘legitimate interest’.
  • We do not use your personal data for any automated decision making or profiling.

 

Applicants

Basis of processing: legitimate interest

1. As part of any recruitment process, the WSTA collects and processes personal data relating to job applicants.

2. The WSTA collects a range of information about you. This includes your name, address and contact details, including email address and telephone number; details of your qualifications, skills, experience and employment history; information about your current level of remuneration, including benefit entitlements; whether or not you have a disability for which the WSTA needs to make reasonable adjustments during the recruitment process; and information about your entitlement to work in the UK.

3. The WSTA collects this information in a variety of ways. For example, data might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. The WSTA may also collect personal data about you from third parties, such as references supplied by former employers. The WSTA will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.

4. Data will be stored in a range of different places, including on your application record, in HR management systems and on other IT systems (including email).

5. The information is not normally disclosed to anyone except those on the hiring panel and the Head of Corporate Services.

6. In case of a dispute, or for legal purposes, we may need to disclose this information to the authorities or to other legal professionals.

7. For unsuccessful candidates, we retain application data for up to 6 months after the recruitment exercise.

 

  • The legal basis for processing your data is ‘legitimate interest’. The WSTA has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Processing data from job applicants allows the WSTA to manage the recruitment process, assess and confirm a candidate's suitability for employment and decide to whom to offer a job. The WSTA may also need to process data from job applicants to respond to and defend against legal claims.
  • We do not use your personal data for any automated decision making or profiling.

 

Your privacy rights explained

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

  • Right of access – you have the right to request a copy of the information that we hold about you free of charge.
  • Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
  • Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
  • Right to restriction of processing – where certain conditions apply, to have a right to restrict the processing.
  • Right of portability – you have the right to have the data we hold about you transferred to another organisation.
  • Right to object – you have the right to object to certain types of processing such as direct marketing.
  • Right to object to automated processing, including profiling – you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or that significantly affects you.
  • Right to judicial review – if the WSTA refuses your request under rights of access, we will provide you with a reason as to why. You have the right to make a complaint as outlined below.

All of the above requests will be forwarded on should there be a third party involved in the processing of your personal data.

 

Changes to our privacy policy

We keep our privacy policy under regular review and we will place any updates on this web page. This privacy policy was last updated on 30th October 2018.

 

How to contact us about your rights or make a complaint

If you wish to exercise your rights or make a complaint about how your personal data is being processed by the WSTA (or third parties above) you should contact the WSTA in the first instance.  If you wish to complain about the WSTA’s processing of your data, or how your complaint has been handled, you have the right to lodge a complaint directly with the ICO and the WSTA’s data protection representative:

 

WSTA

[email protected]

International Wine & Spirit Centre,

39-45 Bermondsey Street,

London,

SE1 3XF

Tel: +44 (0) 20 7089 3877

 

Information Commissioner’s Office

www.ico.org.uk

Information Commissioner's Office,

Wycliffe House,

Water Lane,

Wilmslow,

Cheshire,

SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)


Twitter @wstauk

Today's announcement of the postponement of the vote on the #Brexit deal only compounds uncertainty for businesses… https://t.co/K2MOoi4KR5


WSTA's @RebekahRRK presented alongside the British Ambassador to Italy @UniLUISS with #UIV on Brexit contingency pl… https://t.co/h5gZ7HjLgI


The Government must ensure that immediately post #Brexit there is tariff free access to the EU market for UK produc… https://t.co/Hr3ZyhdLPo

Connect with us